10 tickets across 6 weeks. Two engineers, parallel tracks, zero idle time.
Architecture, VPC/IAM/security, core business logic (processor, ETL, comparison engine), SAP coordination, code review, cutover. ~40% of total work.
CDK stacks (S3, DynamoDB, ECS, CF), CI/CD, Lambda replication, React frontend, Docker, validation scripts, monitoring, tests. ~60% of total work.
| Task | Owner |
|---|---|
| Design VPC (public/private subnets, NAT, security groups) | Tech Lead |
CDK project scaffolding (infra/, app.py, base stacks) | Full-Stack |
| Secrets Manager entries (SAP API creds, JWT secret) | Tech Lead |
| GitHub Actions: Infrastructure pipeline (cdk diff → deploy) | Full-Stack |
| GitHub Actions: Backend pipeline (Docker → ECR → ECS) | Full-Stack |
| GitHub Actions: Frontend pipeline (build → S3 → CloudFront) | Full-Stack |
| GitHub Actions: Lambda/ETL pipeline (package → deploy) | Full-Stack |
| ECR repository CDK construct | Full-Stack |
cdk deploy creates VPC + networking. 4 CI/CD pipelines run on push. Secrets stored.| Task | Owner |
|---|---|
| S3 buckets CDK (6 buckets, lifecycle policies, SSE-KMS) | Full-Stack |
| DynamoDB tables CDK (4 tables, on-demand billing) | Full-Stack |
| S3 Object Lock for audit bucket (COMPLIANCE mode, 7yr) | Tech Lead |
| Cross-account S3 bucket policy (SD-WAN → IOR read) | Tech Lead |
| IAM roles: Lambda execution, ECS task role, S3 policies | Tech Lead |
| Task | Owner |
|---|---|
Write ingest-product-weights Lambda template (ZFMIOR002 → S3) | Tech Lead |
| SQS Dead Letter Queue + 3x retry → SNS alert | Tech Lead |
| EventBridge schedules (daily + weekly) | Full-Stack |
| Replicate pattern for remaining 6 ingestion Lambdas | Full-Stack |
| Unit tests for all 7 Lambdas (mock SAP responses) | Full-Stack |
| Task | Owner |
|---|---|
etl-product-master (merge ZFMIOR002+ZEMM005, derived weights) | Tech Lead |
etl-hts-reference (cross-reference, rate validation) | Tech Lead |
etl-transactions (parse ZSDR002/ZEMM004) | Tech Lead |
| Schema validation framework (shared across ETL) | Tech Lead |
etl-packaging (simple normalize) | Full-Stack |
| SNS quality alert integration | Full-Stack |
| Tests: ETL output matches current CSV data | Full-Stack |
| Task | Owner |
|---|---|
| Shadow mode flag (pipeline writes DynamoDB, app reads CSVs) | Tech Lead |
| Validation: ProductMaster vs Product_List.csv | Full-Stack |
| Validation: HTSReference vs HTS_Code.csv | Full-Stack |
| Validation: TariffSequencing vs HTS Tariff.csv | Full-Stack |
| Validation: PackagingMaterials vs Packaging_Material.csv | Full-Stack |
| Fix data mapping mismatches | Tech Lead |
| Task | Owner |
|---|---|
Refactor data_loader.py: DynamoDB reads + TTL caching + fallback | Tech Lead |
Add GET /api/customs-lines endpoint | Full-Stack |
Add POST /api/compare endpoint | Full-Stack |
| Dockerfile for FastAPI app | Full-Stack |
| CDK: ECS Fargate (1 vCPU/2GB), ALB, auto-scaling | Full-Stack |
| CDK: WAF rules on ALB | Full-Stack |
| Test: processor.py identical output from DynamoDB vs CSV | Tech Lead |
| Task | Owner |
|---|---|
| CDK: S3 + CloudFront distribution + OAC | Full-Stack |
| Build Customs Lines Dashboard page | Full-Stack |
| Build Comparison Report page | Full-Stack |
| Wire dashboards to API endpoints | Full-Stack |
| UX review and design direction | Tech Lead |
| Code review all new components | Tech Lead |
| Task | Owner |
|---|---|
Fix main.py: remove TESTING_MODE, fix DI chain | Tech Lead |
Migrate users.json → DynamoDB Users table | Tech Lead |
Update user_storage.py to DynamoDB | Tech Lead |
| Frontend: remove mock admin, uncomment auth check | Full-Stack |
| Test login/logout for admin & operator roles | Full-Stack |
Add credentials: 'include' to audit HTML fetches | Full-Stack |
| Task | Owner |
|---|---|
generate-customs-lines Lambda (reuses processor.py) | Tech Lead |
| EventBridge daily trigger (after ETL) | Tech Lead |
comparison.py engine (field-by-field, tolerances) | Tech Lead |
| Comparison Lambda (chained after generation) | Tech Lead |
| SNS discrepancy alerts | Full-Stack |
| Integration tests: generate → compare → report | Full-Stack |
| Comparison report UI component | Full-Stack |
| Task | Owner |
|---|---|
| CloudWatch dashboards CDK | Full-Stack |
| CloudWatch alarms (ETL fail, SAP down, comparison fail) | Full-Stack |
| SNS → email/Slack alert routing | Full-Stack |
| Parallel run: old system alongside new (3-5 days) | Tech Lead Full-Stack |
| Validate output parity: manual = automated | Tech Lead |
| Production runbook (restart, rollback, health checks) | Full-Stack |
| Cutover decision and execution | Tech Lead |
| Verify manual upload fallback post-cutover | Full-Stack |
| Ticket | Tech Lead | Full-Stack | Week |
|---|---|---|---|
| T1 Infra + CI/CD | 30% | 70% | 1 |
| T2 Storage Layer | 30% | 70% | 1 |
| T3 Ingestion Lambdas | 35% | 65% | 2 |
| T4 ETL Processing | 70% | 30% | 3 |
| T5 Shadow Validation | 20% | 80% | 3 |
| T6 Backend → ECS | 40% | 60% | 4 |
| T7 Frontend → CF | 15% | 85% | 5 |
| T8 Auth Fix | 65% | 35% | 4 |
| T9 Auto-Gen + Compare | 70% | 30% | 5 |
| T10 Monitor + Cutover | 35% | 65% | 6 |
Tiny data volume (~73 products, ~67 packaging, ~21 HTS). Lambda + pandas is 35x cheaper than Glue.
Lowest risk. Move users.json to DynamoDB. Defer Cognito/Entra ID until M365 decision is final.
| Risk | Mitigation |
|---|---|
| SAP team delays on 6 APIs | Build against mocks from day 1. Swap URLs when APIs ship. |
| 6 weeks is tight | Parallel tracks every week. No idle time. Daily standups. |
| Cross-account S3 complexity | Agreed Mar 26 meeting. Test in Week 1. |
| Auth migration breaks things | T8 isolated in Week 4. Test in staging first. |
| Processor output differs | Shadow mode (T5 Week 3) catches before cutover. |
| Scope creep | Document Distribution Pipeline is OUT. No exceptions. |